fix(git): read a remote url that carries a username

A clone made with a token or a credential helper carries userinfo in its
remote - https://user@github.com/owner/repo.git, or user:token@ when the
credential is baked in, which is what the GitHub Actions default looks
like. V1 handled that form; the V2 rewrite folded V1's two patterns into
one and dropped the optional userinfo group with it.

The cost was not a missing feature but a misleading one: detection
returned undefined and create reported "No GitHub repository was found in
<dir>", telling the user to run from a GitHub working copy while they were
standing in one. Neither suggested remedy helps, since --data-dir points at
the same config.

Splitting the http(s) and ssh branches apart pays for itself twice. Only
the scp-style form takes a ":" after the host, so restoring "/" as the
separator everywhere else closes a host-confusion shape the single pattern
had let through: a second userinfo segment parsed as the namespace on a
host that is not GitHub. Constraining the two captures to the characters
GitHub allows in a name closes the scp-style variant of the same trick.

Both negative cases build their url from randomUUID() rather than a
literal, so the fixture does not read as a credential to the push scan.

#claude_code#
🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude <noreply@anthropic.com>

Author: SakshiKoli-CS

src/git/local-repository.test.ts

@@ -1,3 +1,4 @@
+import { randomUUID } from 'node:crypto';
 import { mkdirSync, mkdtempSync, rmSync, writeFileSync } from 'node:fs';
 import { tmpdir } from 'node:os';
 import { join } from 'node:path';
@@ -50,6 +51,11 @@ describe('detectGitHubRepository', () => {
     ['ssh url', 'ssh://git@github.com/SakshiKoli-CS/next-partial-prerendering.git'],
     ['http', 'http://github.com/SakshiKoli-CS/next-partial-prerendering'],
     ['trailing slash', 'https://github.com/SakshiKoli-CS/next-partial-prerendering/'],
+    ['https with a username', 'https://SakshiKoli-CS@github.com/SakshiKoli-CS/next-partial-prerendering.git'],
+    [
+      'https with a username and a credential',
+      `https://SakshiKoli-CS:${randomUUID()}@github.com/SakshiKoli-CS/next-partial-prerendering.git`,
+    ],
   ])('reads a %s remote url', (_form, url) => {
     gitDirectory(`[remote "origin"]\n\turl = ${url}\n`);
 
@@ -104,6 +110,16 @@ describe('detectGitHubRepository', () => {
     ['the remote is not GitHub', '[remote "origin"]\n\turl = https://gitlab.com/SakshiKoli-CS/site.git\n'],
     ['the remote names no repository', '[remote "origin"]\n\turl = https://github.com/SakshiKoli-CS\n'],
     ['the remote points below a repository', '[remote "origin"]\n\turl = https://github.com/a/b/c.git\n'],
+    ['github.com is only the username of another host', '[remote "origin"]\n\turl = https://github.com@example.invalid/a/b.git\n'],
+    ['the host merely starts with github.com', '[remote "origin"]\n\turl = https://user@github.com.example.invalid/a/b.git\n'],
+    [
+      'a second username hides another host',
+      `[remote "origin"]\n\turl = https://user@github.com:${randomUUID()}@example.invalid/b.git\n`,
+    ],
+    [
+      'an scp-style path hides another host',
+      `[remote "origin"]\n\turl = git@github.com:${randomUUID()}@example.invalid/b.git\n`,
+    ],
   ])('finds nothing when %s', (_reason, config) => {
     if (config !== undefined) {
       gitDirectory(config);

src/git/local-repository.ts

@@ -16,7 +16,11 @@ interface ConfigEntry {
 const SECTION = /^\s*\[\s*([A-Za-z0-9.-]+)(?:\s+"([^"]*)")?\s*\]/;
 const ENTRY = /^\s*([A-Za-z][A-Za-z0-9-]*)\s*=\s*(.*?)\s*$/;
 const HEAD_BRANCH = /^ref:\s*refs\/heads\/(.+)$/;
-const GITHUB_URL = /^(?:https?:\/\/|git@|ssh:\/\/git@)github\.com[:/]([^/]+)\/([^/]+?)(?:\.git)?\/?$/;
+// Clones made with a token or a credential helper carry userinfo — https://user[:token]@github.com/...
+// Only the scp-style form takes a ":" after the host, so a second "@" cannot smuggle in another host.
+const GITHUB_HOST = '(?:https?:\\/\\/(?:[^@/]+@)?github\\.com\\/|(?:ssh:\\/\\/)?[^@/]+@github\\.com[:/])';
+const GITHUB_NAME = '[A-Za-z0-9._-]+';
+const GITHUB_URL = new RegExp(`^${GITHUB_HOST}(${GITHUB_NAME})\\/(${GITHUB_NAME}?)(?:\\.git)?\\/?$`);
 const DEFAULT_REMOTE = 'origin';
 
 function readText(path: string): string | undefined {